At the end of April, with the global pandemic in full swing, the World Economic Forum (WEF) published a prescient warning. The warning appeared in an article on the WEF website by Leo Simonovich, vice president and global head of industrial cyber and digital security at Siemens, titled “Why COVID-19 is making utilities more vulnerable to cyberattack—and what to do about it.” Simonovich reported on two key challenges that utilities and the energy industry are currently facing, which have been exacerbated by the coronavirus crisis:

• Utility companies now have new and heightened risks of becoming victims of cybercrime with so many employees in the energy industry are now working remotely.
• These new “weak points in organizations’ infrastructure” are ripe to be exploited by hackers and attackers.

Simonovich notes that while keeping utility workers safe has, of necessity, become top priority along with keeping customers supplied with power, remote working creates new cyber-risks.

As the article states:

“By accessing critical plant production and grid networks from homes, employees raise the risk of a possible second-wave crisis: rolling outages and safety events at a time when keeping the lights on matters most. Attackers will attempt to exploit the rush to remote systems, understaffed facilities and new ways of working.”

Multiplied risks

As in any industry, remote working, while creating the necessary safety and convenience for employees, creates additional vulnerabilities for the energy industry and its organizations. That’s because, as the article states, risks are now multiplied, “coming both from inside and outside the walls” of its cyber defenses.

Simonovich points out that understanding the new risks is the first step toward increasing security. I have to agree. Utility companies face the same security challenges that other companies face when employees work from home, such as unreliable or even sketchy Internet connections, inadvertent user errors that open networks up to attackers, and the possibility of third parties compromising cybersecurity. But when utility companies have their cybersecurity breached, the damages can affect far more than the company and its employees, causing negative consequences on a global scale. As reported in an energy trade publication

“Resiliency is no longer something we desire; it is essential. Electricity now plays a key role in the operation of advanced industrialized nations. Water, communications, national defense, health systems and financial networks all depend on an extremely reliable electric infrastructure.”

Another industry trade reported in mid-April that as utility systems become increasingly connected, that reality “has a dark side in that it introduces new entry points and, by extension, increased vulnerability. As networks become more distributed, they become increasingly susceptible to hacking and cyberattacks.”

Securing the grid

So how can utility companies shore up the security of the grid and remain operationally viable in this unprecedented time of COVID-19, with so many remote workers among their ranks exposing the industry to potentially catastrophic situations that could leave millions of customers literally in the dark? The key is to deploy a software-defined perimeter (SDP).

SDP software enables what essential businesses like utilities need: “zero trust” architecture. What this means for at-home utility workers is that when they’re using their devices while working remotely, instead of having full, unrestricted network access, they only have access—sanctioned by IT— to specific applications that they need access to. That’s true both for datacenter-based and cloud-based applications.

Network-level access creates security gaps that application-level access doesn’t, and this is why SDP technology is so effective from a cybersecurity standpoint. SDP prevents the possibility of lateral attacks, creating a “secure by default” environment that safeguards grid resiliency.

SDP technology boosts security for the energy industry in other ways as well. It’s invisible to hackers since it leverages an enhanced user datagram protocol (UDP) with ports that are randomly generated. SDP software can also fortify security by making micro-tunnels undetectable to anyone who isn’t authorized to access them. The micro-tunnels are also encrypted, and public key authentication allows for secure connectivity with direct data transport, again both for cloud and on-premises locations. With highly available tunnels and built-in failover, SDP is also high performing, and the software avoids the typical troubles and security flaws inherent in virtual private networks (VPNs).

To avoid the crises that can occur when huge parts of the grid lose power, utility companies and the energy industry need a way to mitigate the cyber-risks inherent in having so many employees working from home during COVID-19. Secured by SDP with its discreet microtunnels and random port generation, utility companies can regain the cybersecurity and protection they need in these challenging times.